v1.2.0

v1.2.0

Review and hardening release. It closes gaps in the tier boundary itself, makes the audit and the
recovery script do what their documentation says, and adds the pieces the review found missing:
a neutral landing zone for new computers, Kerberos armoring for enforceable silos, checks of the
attack paths into Tier 0, account and access group hygiene, DSRM through LAPS, and CI.

Run Update-TierConfiguration.ps1 on an existing configuration before the next deploy, then
review the plan: it moves groups, adds deny ACEs and GPO settings. The neutral staging OU is
added disabled by the updater - switching it on is a decision.

Security

• The break-glass account is kept out of the authentication policy silos. Silo membership
  was derived from the role groups without looking at excludeFromSilo, so the break-glass
  account - a member of G-T0-Admins - was assigned like every other administrator, contrary to
  the README. Accounts marked excludeFromSilo are now skipped; if one is already assigned,
  audit reports it as a High finding and deploy/sync removes the assignment.
• Operators no longer hold every control access right on the service account OU. The
  delegation ReadProperty, ExtendedRight without an object type granted all extended rights,
  Reset Password on service account users included - Tier 0 operators could take over Tier 0
  service accounts. It never granted gMSA password retrieval either; that is controlled per
  account by PrincipalsAllowedToRetrieveManagedPassword. The delegation is gone from the
  generator and the shipped configuration. The tool only adds ACEs, so remove an existing one
  by hand, per tier, on OU=Service-Accounts,OU=<tier>,OU=<root>,..., for example with
  dsacls "<OU DN>" /R "<DOMAIN>\G-T0-Operators" (this removes all explicit ACEs of that
  group on the OU - there are no others in the shipped model).
• Deny logon and GPO exception groups live in the top tier. Kept in their own tier's branch,
  they were writable by that tier's administrators through the branch delegation: a Tier 2 admin
  could remove G-T0-Admins from DL-T2-DenyLogon or exempt workstations from
  T2-Logon-Restrictions, switching off exactly the protection Tier 0 credentials rely on.
  Both groups now default to Tier-0/Groups, and existing groups are moved there by the Group
  and GPO stages (new Move-TierObjectToOu; audit reports a misplaced group as drift).
• Tier administrators below the top tier cannot block Group Policy inheritance. The branch
  delegation includes WriteProperty on every sub-OU and with it gPOptions. A deny on
  gPOptions for the tier admin group is now part of the granular delegation. The LAPS policy
  link, which a Block Inheritance used to switch off, is now enforced like the other tier links.

Added

• Neutral staging OU. A staging block, expanded at load time like roles, creates
  OU=Staging below the model root: a deny logon group holding every role group of every tier,
  a quarantine GPO denying them logon, a join group with the domain-join set and nothing else,
  top tier management of the OU and a LAPS policy readable by the top tier only.
  redirectComputersTo: "$Staging" sends new computers there instead of into the lowest tier,
  whose administrators used to control every new server until somebody classified it. The audit
  lists machines waiting there and for how long. New OU reference $Staging.
• Kerberos armoring. The DC baseline carries KDC support for claims, compound
  authentication and Kerberos armoring (level Supported), every tier GPO the matching client
  setting. Test-TierKerberosArmoring checks configuration and deployed policy.
• Two-way silo reconciliation. Objects assigned to a silo that no longer qualify are
  reported, or removed with options.authenticationPolicySiloReconcile: "Enforce". An account
  that qualifies for two silos is a High conflict and is assigned to neither, instead of flapping
  between them on every run.
• Attack path checks in the audit (Test-TierAttackPath, attackPathChecks block): dangerous
  ACEs and foreign owners on the domain head (DCSync included), AdminSDHolder, the Policies
  container, the Domain Controllers OU and